Privacy Policy

Who we are

Spilld LLC ("Spilld", "we", "us") is a Virginia limited liability company based in Ashburn, Virginia. You can reach us at hello@spilld.ai. This policy covers spilld.ai and the audits we run, and it was last updated on October 18, 2026. Spilld is for businesses and is not meant for children.

What we collect

When you ask for an audit, you give us your name and email address, the business's name, city, state, ZIP code and website, a nearby landmark if you choose to give one, and the services you want measured.

If you ask for an agency account, you give us your agency's name and email address. We create agency accounts by invitation only.

When you send an audit request or an agency access request, we record the time and your IP address, to stop abuse and to enforce a daily limit on requests. We also record that you accepted our terms, and when. Our own code does not store your browser type. Our web server and the proxy in front of it may also log each visit, including your IP address and the page you asked for.

Our pages currently load their fonts from Google, so Google receives your IP address and browser details when a page loads. A report opens at a private link and loads nothing from other sites, except that a white-labelled report loads the agency's logo from the web address the agency gives us, which then sees the viewer's IP address. We use no analytics, advertising or error-reporting service.

How an audit works and who receives data

To run an audit, we write questions and send them to four AI services: OpenAI, Anthropic, Google (Gemini) and Perplexity. We record their answers. Every question is asked with web search on, and also with it off to every service except Perplexity, which always searches. We keep each service's answer, and the web addresses and titles of the pages it cites and of the search results it returns. Records of audits run before October 18, 2026 also hold short excerpts from those pages.

A few of our questions name the business, and many give its city, state and ZIP code (and a nearby landmark, if you gave one). We never send a street address, a phone number or a website, and we do not send your name or email address. OpenAI also receives the business's name and city together with every service's answer, so an automated judge can classify the answers.

We also look up your business and the businesses the assistants name on Google Maps, to confirm they are real. We send Google the business's name with the city and state. We keep the place ID Google returns for each business, and Google's name and street address for your own business. From October 18, 2026, we do not keep the street address Google lists for the other businesses the assistants named; reports from earlier audits can still show it. We do not keep ratings, hours, phone numbers or websites from Google. Google's handling of information is described in Google's Privacy Policy, which applies to our use of Google services.

We send email through SendGrid. Those emails carry report links, and the messages we send ourselves include the requester's name and email address. Spilld runs on a DigitalOcean server, and hourly backups go to a DigitalOcean storage bucket.

We share information with the services named above so they can do their part, and when the law requires it.

Other businesses and people who appear in an audit

The answers and search results can include business names, addresses, phone numbers and emails, and sometimes the names of people who run those businesses. We did not ask those businesses or people for this information, and we did not choose them. The AI services named them. A report says that a shop was named and how often. It does not say a shop is good or bad.

If you are named and believe something is wrong, or you want an item taken out, email us what and where. We will check that you are the business or person concerned, for example from an email sent from the business's own address or a match to its Google listing. We will reply within 30 days and tell you what we decided. We may take an item out of a report, or we may decline.

How long we keep it

We keep each audit record for 18 months after the audit date. After that, we delete the AI responses, citations and search results, and we keep the results we calculated from them, such as counts, verdicts and which businesses were named. We keep requester contact details for 24 months after your last activity, or until you ask us to remove them, whichever comes first. We keep the IP address recorded with a request for 90 days.

We are still building the tools that do this deletion, including for backup copies. They will be running before any record reaches these limits.

Your choices and how to reach us

You can ask us to correct or remove information we hold about you, or to end an audit you asked for early. Email hello@spilld.ai. We will check who you are and reply within 30 days with what we can do. Depending on where you live, privacy law may give you rights to see, correct or delete personal information, and we will tell you which apply to your request.

If we change this policy, we will post the new date at the top. A change applies to audits requested after it takes effect.

Spilld LLC, hello@spilld.ai.